Reject unreadable UCE source units

docs/wasm-runtime-architecture.md

@@ -146,6 +146,12 @@ compiler error rather than serving the old unit indefinitely. The per-unit lock
 also keeps concurrent synchronous compilers from waiting across a transitive
 graph when a last complete artifact is available.
 
+Before preprocessing, the compiler verifies that the worker can actually read
+the source. An unreadable path is a compile failure with a persisted diagnostic;
+it never becomes an apparently valid empty side module. Source signatures mark
+unreadable inputs, so correcting access invalidates that failure and permits a
+normal retry without changing signatures for ordinary readable files.
+
 ---
 
 ## 4. The workspace runtime
@@ -351,7 +357,9 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   `scripts/test_dependency_invalidation.sh`. The latter changes a transitive
   `#load`, then replaces a warmed worker artifact while preserving its
   whole-second mtime to prove both compiler and worker caches invalidate it. It
-  also sends 48 requests and asserts the observed worker PID set does not exceed
+  also rejects an unreadable unit without publishing a wasm artifact, restores
+  its permissions and proves the next CLI request compiles it, then sends 48
+  requests and asserts the observed worker PID set does not exceed
   `WORKER_COUNT`, guarding against accidental reintroduction of request-count
   recycling.
   `scripts/test_cold_component_deadline.sh` separately compiles a deliberately